OpenBao: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Mediumbsi:WID-SEC-2026-20284 linked CVEs
Open advisory with all CVEs
More on OpenBao
Other advisories
- Not ratedosv:CLEANSTART-2026-CL56370Security fix for GHSA-hfvc-g4fc-pqhx applied in: kube-state-metrics 2.18.0-r2, bank-vaults 1.32.1-r1, etcd 3.6.10-r0, grafana 13.0.0-r0, minio 0.20250907.161309-r3, openbao 2.5.4-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, temporal-server-fips 1.31.1-r1, kube-state-metrics 2.17.0-r1, cortex 1.21.1-r2, cortex 1.21.1-r3, thanos 0.41.0-r0, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.10.0-r1
- Not ratedosv:CLEANSTART-2026-SG72830Security fix for GHSA-mh2q-q3fh-2475 applied in: bank-vaults 1.32.1-r1, minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, haproxy-ingress 0.15.4-r0, openbao 2.5.4-r1, argo-cd-fips 3.3.7-r0, cortex 1.21.1-r2, cortex 1.21.1-r3, external-secrets-operator-fips 2.4.1-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2, prometheus 3.10.0-r1
- Not ratedosv:CLEANSTART-2026-TI30680Security fix for GHSA-p77j-4mvh-x3m3 applied in: bank-vaults 1.32.1-r1, gitea 1.25.5-r0, minio 0.20250907.161309-r0, rclone 1.73.2-r0, openbao 2.5.4-r1, velero 1.16.2-r4, cortex 1.21.1-r2, cortex 1.21.1-r3, traefik 3.6.11-r4, smarter-device-manager 1.20.11-r1, smarter-device-manager 1.20.11-r2, velero-plugin-for-aws 1.11.1-r2, calico 3.31.4-r0, kube-state-metrics 2.16.0-r5, fulcio 1.8.7-r2, metrics-server 0.8.1-r2, metrics-server 0.8.1-r3, prometheus 3.9.1-r1
- Not ratedosv:CLEANSTART-2026-XC19453Security fix for GHSA-78h2-9frx-2jm8 applied in: bank-vaults 1.32.1-r1, opentofu-fips 1.10.9-r4, openbao 2.5.4-r1, velero 1.16.2-r5, temporal-server-fips 1.31.1-r1, opentofu-fips 1.11.5-r3, consul 1.20.6-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2
- Not ratedosv:CLEANSTART-2026-VG29890Security fix for GHSA-gcjh-h69q-9w9g applied in: cert-manager 1.18.6-r4, kube-state-metrics 2.20.0-r0, kyverno 1.18.2-r1, rabbitmq-cluster-operator 2.20.1-r5, rabbitmq-cluster-operator 2.21.1-r2, kedacore-http-add-on 0.15.0-r0, kubernetes-csi-external-resizer 2.0.0-r2, kedacore-http-add-on 0.13.0-r0, kyverno 1.17.2-r2, yunikorn-k8shim 1.8.0-r1, rabbitmq-messaging-topology-operator 1.19.3-r2, tekton-chains 0.29.7-r1, kube-state-metrics 2.18.0-r7, kube-state-metrics 2.19.1-r1, external-secrets-operator-fips 2.7.0-r1, eks-distro-kube-scheduler 1.36.9-r1, kube-rbac-proxy-fips 0.22.0-r1, cluster-autoscaler 1.35.2-r1, cluster-autoscaler 1.36.1-r1, cluster-autoscaler 1.36.1-r6, cluster-autoscaler 1.36.1-r7, kubernetes 1.33.13-r0, openbao 2.6.3-r1, helm-operator 1.39.2-r1, helm-operator 1.42.3-r2, helm-operator 1.40.0-r1, calico 3.30.7-r6, fluent-operator 3.10.0-r0, metallb 0.16.0-r2, calico 3.32.1-r1, kube-state-metrics 2.16.0-r9, grafana-org-operator 1.13.0-r0
- Not ratedosv:CLEANSTART-2026-QD11639Security fix for GHSA-8wmf-6v46-5gfg applied in: cluster-autoscaler-fips 1.33.6-r2, weaviate-fips 1.38.19-r1, eks-distro-kube-apiserver 1.36.8-r1, kyverno 1.19.1-r1, openbao 2.6.3-r1, thanos 0.39.2-r7
- Not ratedosv:CLEANSTART-2026-KQ73125Security fix for GHSA-j88v-2chj-qfwx applied in: grafana 13.0.1-r0, openbao 2.5.4-r1, temporal-server-fips 1.31.1-r1, kumactl 2.14.0-r1
- Not ratedosv:CLEANSTART-2026-LA75806Security fix for GHSA-pjcq-xvwq-hhpj applied in: minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, openbao 2.5.4-r1, yunikorn-k8shim 1.8.0-r1, external-secrets-operator-fips 2.4.1-r0
Other news entries
- OpenBao: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenBao: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
- OpenBao: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2028
ID